1.1 This Privacy Policy explains how Quantafin Lab LLC ("Quantafin", "we", "us" or "our"), a Wyoming limited liability company with its business address at 2025 Briarcliff Road, Lewisville, Texas 75067, U.S.A., collects, uses, shares and protects personal information in connection with the Blokduck software (the "Software"), the website at blokduck.com (the "Website") and any related services.
1.2 We are the organisation responsible for (the "controller" of) the personal information described in this Policy. You can contact our Privacy Officer at [email protected].
1.3 This Policy should be read together with the Blokduck End User Licence Agreement (the "Licence Agreement"). Terms defined in the Licence Agreement have the same meaning here.
2.1 The Software processes your Documents locally on your own device or infrastructure. We do not receive, see, store or have access to your Documents, Protected Copies, reports, key files or anything else you process with the Software.
2.2 The Software's redaction engine collects no telemetry or usage analytics, performs no crash reporting, makes no update checks, and validates Licence Keys entirely offline.
2.3 We collect a limited amount of personal information only when you visit the Website, buy a plan, request a Licence Key, engage us for Services or contact us.
2.4 We do not sell your personal information, and we do not use it for targeted advertising.
Because the Software runs locally, we do not collect:
3.1 the contents of any Document you process, or any value detected, replaced or recovered by the Software;
3.2 your Protected Copies, private reports or key files;
3.3 information about how, when or how often you use the Software on your device; or
3.4 crash reports, diagnostics or device identifiers from the Software.
4.1 Purchase and account information. When you buy a plan or request a Licence Key, we collect your name, email address, organisation name, billing address, number of Seats, plan details and the Licence Keys issued to you.
4.2 Payment information. Payments are processed by Stripe. Your card details are entered directly with Stripe and are not received or stored by us. Stripe shares with us limited information such as the payment status, amount, card type and last four digits, and billing country.
4.3 Communications. When you email us or ask for support, we collect your name, contact details and the content of your message, including any attachments you choose to send.
4.4 Services. If you engage us for Services, we collect the contact and business information needed to deliver them. If you choose to send us sample or other Documents for a Service, we handle them as described in section 7.
4.5 Website analytics. When you visit the Website, we collect information about your visit, such as the pages you view, the links you click, how long you spend on each page, the website that referred you, your approximate location (country or city, derived from your IP address), and your browser and device type. We use this in aggregate to understand how the Website is used and to improve it. See section 8 on cookies.
4.6 Server logs. Our website host automatically records standard technical information, such as IP address, date and time of request and browser type, to operate and secure the Website.
We use personal information only to:
5.1 provide, issue and manage plans, Seats and Licence Keys;
5.2 process payments, send invoices and receipts, and keep financial records;
5.3 respond to questions and provide support and Services;
5.4 send important notices about the Software, your plan or the Licence Agreement;
5.5 understand and improve the Website;
5.6 protect the security of our systems and prevent fraud and misuse;
5.7 send product news or marketing emails, but only where you have consented or the law otherwise permits. You can unsubscribe at any time using the link in each email; and
5.8 comply with legal, tax and accounting obligations, and establish, exercise or defend legal claims.
If the GDPR or UK GDPR applies to you, we rely on the following legal bases:
6.1 Contract: to provide plans, Licence Keys, support and Services you request (sections 5.1 to 5.4).
6.2 Legitimate interests: to understand and improve the Website, secure our systems and defend legal claims (sections 5.5, 5.6 and 5.8), where those interests are not overridden by your rights.
6.3 Consent: for marketing emails and for any non-essential cookies or analytics that require consent (sections 5.7 and 8). You may withdraw consent at any time.
6.4 Legal obligation: to keep tax, accounting and other records we are required to keep.
7.1 We ask that you send us only sample, test or de-identified Documents, unless we have agreed otherwise in an Order.
7.2 If you send us a Document, we use it only to perform the Service you requested, limit access to the people who need it for that Service, and delete it when the Service is complete or earlier at your request.
7.3 You are responsible for making sure you are entitled to share any Document with us. Where a Document contains personal information about other people, you remain the controller of that information and we process it on your behalf and on your instructions.
8.1 The Website may use cookies or similar technologies to measure visits and page activity as described in section 4.5. Where the law requires it, including for visitors in the EU and UK, we will ask for your consent before setting non-essential cookies, and you can change your choice at any time.
8.2 You can also block or delete cookies through your browser settings. Blocking cookies will not affect your ability to download or use the Software.
8.3 The Software itself does not use cookies. The browser-based interface of the Software loads fonts from Google Fonts and the PDF.js and jsPDF libraries from public content delivery networks. Those providers may receive technical information, such as your IP address and browser details, when these files load, and handle it under their own privacy policies. Your Documents are never sent to them.
We share personal information only as follows:
9.1 Service providers: with companies that help us run our business, such as Stripe (payments), our website host, our website analytics provider, and our email provider. They may use personal information only to provide services to us.
9.2 Professional advisers: with our accountants, lawyers and auditors where needed.
9.3 Legal requirements: where required by law, court order or a lawful request from a public authority, or to protect our rights, property or safety or those of others.
9.4 Business transfers: with a buyer or successor in connection with a merger, acquisition or sale of all or part of our business, subject to this Policy.
We do not sell personal information and do not share it for cross-context behavioural or targeted advertising.
10.1 We are based in the United States, and our team and service providers operate in the United States, Canada and Europe. Your personal information may therefore be processed in countries other than where you live, including the United States, where data protection laws may differ from those in your country.
10.2 Where we transfer personal information from the EU, the UK or Switzerland to a country that does not have an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum), or on a service provider's certification under the applicable Data Privacy Framework. You can ask us for more information about these safeguards.
10.3 If you are in Canada, your personal information may be accessible to courts, law enforcement and national security authorities in the countries where it is processed.
11.1 Purchase, billing and tax records: for as long as tax, accounting and corporate laws require, generally up to seven (7) years after the relevant transaction.
11.2 Licence and account information: for as long as your plan or Licence Key is active, and for up to two (2) years afterwards so we can reissue keys and answer questions.
11.3 Support and general correspondence: for up to two (2) years after the matter is closed.
11.4 Documents sent for Services: until the Service is complete or earlier on request, as set out in section 7.
11.5 Website analytics: in aggregated or de-identified form where possible, and identifiable analytics data for no longer than twenty-six (26) months.
When we no longer need personal information, we delete or de-identify it.
We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information, including access controls, encryption in transit and limiting access to those who need it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach of security creates a real risk of significant harm, or otherwise requires notice under applicable law, we will notify affected individuals and regulators as the law requires.
13.1 Depending on where you live, you may have the right to: access the personal information we hold about you; correct inaccurate information; delete your information; restrict or object to certain processing; receive a copy of your information in a portable format; withdraw consent at any time, without affecting processing already carried out; and opt out of marketing.
13.2 Canada. Under PIPEDA and applicable provincial laws, you may access and ask us to correct your personal information and may withdraw consent, subject to legal and contractual restrictions. You may complain to the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.
13.3 United States. If you are a resident of a US state with a consumer privacy law, such as California, you may have the right to know, access, correct and delete your personal information, and to opt out of its sale, sharing for targeted advertising or profiling. We do not sell or share personal information for those purposes. We will not discriminate against you for exercising your rights. You may use an authorised agent, and you may appeal a decision we make about your request by replying to our response.
13.4 EU and UK. You may lodge a complaint with the data protection authority in the country where you live or work, or where you believe an infringement occurred. In the UK, this is the Information Commissioner's Office.
13.5 To exercise any of these rights, email [email protected]. We will verify your identity before acting on a request and respond within the time required by applicable law. Because we do not have access to Your Content, we cannot access, correct or delete information inside Documents you process with the Software.
The Software and Website are not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.
We may update this Policy from time to time. We will post the updated version on the Website with a new effective date and, where the changes are material, notify you by email or through the Website before they take effect.
Quantafin Lab LLC
Attn: Privacy Officer
2025 Briarcliff Road, Lewisville, Texas 75067, U.S.A.
Email: [email protected]